---
title: "Accept an invitation and create the invited user"
method: POST
path: "/auth/invitations/{token}/accept"
tags: ["Auth"]
---

# Accept an invitation and create the invited user

`POST /auth/invitations/{token}/accept`

## Request

- Base URL: `http://localhost:38200`
- URL: `http://localhost:38200/auth/invitations/{token}/accept`
- Auth: none required

Rate-limited per IP.

## Path parameters

- `token` string, required

## Request body

- object
  - `password` string, required: NIST SP 800-63B Rev.4 password-only floor. Accepting an invitation always creates a brand-new user, so the relaxed 8-char MFA-enrolled floor never applies here. Also checked against the HIBP breached-password corpus (fails open on an HIBP outage).

## Response `200`

Invitation accepted. JWT cookie set.

- AuthSessionResponse
  - `user` object
    - `id` integer
    - `email` string, email
    - `role` 'owner' | 'admin' | 'member'
    - `isSuperAdmin` boolean
    - `emailVerified` boolean
    - `createdAt` string, date-time
  - `tenant` object
    - `id` integer
    - `name` string
    - `slug` string
    - `plan` string
    - `createdAt` string, date-time

## Other responses

- `400`: Request body/query failed Zod validation.
- `404`: Resource not found (or not visible to the caller).
- `429`: Rate limit exceeded for this endpoint.

---

[API](https://skmtc.dev/contextq/apis/contextq-api.md) · [All operations](https://skmtc.dev/contextq/apis/contextq-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contextq/apis/contextq-api/revisions/7afc44056a22?raw)